{"record":{"id":"61e387938fdd2c0c","repo":"kubernetes/kops","slug":"error-storing-user-provided-keys-q-q-v","errorCode":null,"errorMessage":"error storing user provided keys %q %q: %v","messagePattern":"error storing user provided keys %q %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":257,"sourceCode":"\t\t\tif keyset, err = fi.NewKeyset(cert, privateKey); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"the first keypair added to a keyset must be primary\")\n\t\t}\n\t\titem = keyset.Primary\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"reading existing keyset: %v\", err)\n\t} else {\n\t\titem, err = keyset.AddItem(cert, privateKey, options.Primary)\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = keyStore.StoreKeyset(ctx, name, keyset)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error storing user provided keys %q %q: %v\", options.CertPath, options.PrivateKeyPath, err)\n\t}\n\n\tif options.CertPath != \"\" {\n\t\tfmt.Fprintf(out, \"using user provided cert: %v\\n\", options.CertPath)\n\t}\n\tif options.PrivateKeyPath != \"\" {\n\t\tfmt.Fprintf(out, \"using user provided private key: %v\\n\", options.PrivateKeyPath)\n\t}\n\tfmt.Fprintf(out, \"Created %s %s\\n\", name, item.Id)\n\treturn nil\n}\n\nfunc completeKeyset(ctx context.Context, cluster *kopsapi.Cluster, clientSet simple.Clientset, args []string, filter func(name string, keyset *fi.Keyset) bool) (keyset *fi.Keyset, keyStore fi.CAStore, completions []string, directive cobra.ShellCompDirective) {\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\tcompletions, directive := commandutils.CompletionError(\"getting keystore\", err)\n\t\treturn nil, nil, completions, directive\n\t}","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L239-L275","documentation":"This error wraps a failure from keyStore.StoreKeyset when persisting the new or updated keyset at the end of `kops create keypair`. Despite the message naming 'user provided keys', it fires for generated keys too; the keyset was built successfully but could not be written to the backing store.","triggerScenarios":"Running `kops create keypair` when the key store backend rejects the write: permission denied on the state store, read-only bucket, Object Lock/retention policies, network failure mid-write, or full disk for file:// stores.","commonSituations":"State store bucket write permissions missing or IAM too restrictive; bucket deny policy or Object Lock; temporary cloud storage outage; disk full for file:// state stores.","solutions":["Verify write permissions on the state store bucket/path for your credentials.","Confirm connectivity with a read command, then retry the write.","Check for Object Lock / retention / read-only bucket settings blocking writes.","For file:// state stores, check disk space and directory permissions."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error storing user provided keys\") {\n    // inspect wrapped cause; verify bucket write IAM; retry with backoff\n}","preventionTips":["Grant the invoking identity write access to the state store prefix.","Verify Object Lock and retention policies don't block overwrites.","Ensure sufficient disk space for file:// state stores.","Retry after transient cloud storage errors."],"tags":["keystore","state-store","write-failure"],"backgroundTag":"state-store-write-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}